Understanding the Bearer-Token
A Bearer-Token is a security credential used in API authentication that grants access to the bearer of the token. It is the most common type of Access-Token used in OAuth-2.0. The security model of a Bearer-Token relies on the fact that any party in possession of the token can use it to access protected resources, similar to a physical key or cash.
Implementation and Usage
In a typical REST-API environment, the token is transmitted in the HTTP-Header using the Authorization key. The format is specified in RFC 6750 as Authorization: Bearer [token]. This mechanism eliminates the need for the Client-Application to manage the user's primary credentials, such as a password, after the initial Authentication phase.
Security Considerations
Because the token itself provides full access, it must be protected from interception. It is mandatory to use Transport-Layer-Security (TLS) to encrypt the communication channel. Many modern implementations use JSON-Web-Token (JWT) as the format for these tokens, allowing the Resource-Server to verify the token's validity and scope without necessarily querying a central database. For further reading on best practices, see the Auth0 Documentation on Bearer Tokens.